fix(pco): decode into uninitialized buffers safely - #11363

## Summary

QC `develop` is missing 13 upstream commits. Merge
`vortex-data/vortex:develop` at
`cb613ac1c0adc56cbe63dfc79e4bbc431ad0bc52` into QC `develop` at
`b2c429ac2830b883cb37c1ff9262dc9e3cb7e483`.

Merge this PR with a merge commit to preserve upstream ancestry for
future syncs.

## Changes

- Import typed Arrow extension plugins and round-trip metadata
preservation, run-end export fixes, and DuckDB dictionary reuse across
chunks ([vortex-data#11360](vortex-data#11360),
[vortex-data#11375](vortex-data#11375),
[vortex-data#11378](vortex-data#11378)).
- Bring in improved string dictionary selection, spatial contains/within
pruning, and safe PCO decoding
([vortex-data#9762](vortex-data#9762),
[vortex-data#11372](vortex-data#11372),
[vortex-data#11363](vortex-data#11363)).
- Include CUDA Widen execution, bounded dictionary gathers,
encoded-child host copies, and string dictionaries in the CUDA
compression preset.
- Reconcile the upstream Java I/O ports with their existing QC
implementations, preserving read metrics, Kryo-safe Hadoop broadcasts,
lifecycle handling, session defaults, and regression coverage. Correct
the coalescing default's Javadoc to 1 MiB.

## Testing

- Pinned `nightly-2026-09-10` Rust formatting for all affected crates,
root/subproject `./gradlew spotlessApply`, and clang-format for the
changed CUDA kernels passed. Reviewed and included the formatter diff.
- `git diff --check` passed; no unresolved merge entries or conflict
markers remain. The worktree is clean and both remote tips are parents
of the signed-off merge commit.
- All 13 imported commits have sign-off trailers and retain their
original upstream metadata.
- Tests, builds, lint, and benchmarks were not run locally, following
repository guidance.

---------

Signed-off-by: Daniel King <[email protected]>
Signed-off-by: Tanish Gudise <[email protected]>
Signed-off-by: Alexander Droste <[email protected]>
Signed-off-by: Christopher Wirt <[email protected]>
Signed-off-by: Nemo Yu <[email protected]>
Signed-off-by: Connor Tsui <[email protected]>
Signed-off-by: Will Manning <[email protected]>
Signed-off-by: Robert Kruszewski <[email protected]>
Co-authored-by: Dan King <[email protected]>
Co-authored-by: Tanish Gudise <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
Co-authored-by: Alexander Droste <[email protected]>
Co-authored-by: Connor Tsui <[email protected]>
Co-authored-by: Nemo Yu <[email protected]>
Co-authored-by: Will Manning <[email protected]>